Before the terrorist attack at two New Zealand mosques, the alleged gunman radicalized, acquired firearms and ammunition, practised at a shooting range and wrote a manifesto.
How did it all go unnoticed?
Researchers have found it rarely does: those preparing to engage in violent extremism tend to follow a sequence of steps that take about a year and signal to bystanders they are up to something.
WATCH: Family of Christchurch suspect ‘gobsmacked’
The stereotype of the self-radicalized lone wolf who suddenly turns violent without anyone knowing is not backed by recent studies by security agencies and academics.
Although the speed has increased, “the majority of individuals still take close to a year to mobilize to violence and demonstrate … behavioral indicators during the mobilization process,” said a declassified Canadian Security Intelligence Service study.
The study, part of a project launched by CSIS after the deadly October 2014 terrorist attacks in Saint-Jean-sur-Richelieu, Que., and Ottawa, also found extremists almost always give themselves away as they get ready.
“Individuals mobilizing to violence — i.e. extremist travel, domestic or foreign attack plotting, or facilitation activities — often inadvertently leak information to other individuals about their intent, capability and preparations,” one of the CSIS studies found.
In a majority of cases, the plotters “engaged in specific, highly incriminating discussion months before mobilization.”
The research underscores the importance of picking up on what officials call “leakage” — the things people say and do that betray to those around them that they are on the path to extremist violence.
WATCH: New Zealand shooting: Man who lost his wife says he forgives suspected shooter
Fifty people were fatally shot at two New Zealand mosques last week. An Australian who had allegedly penned a manifesto espousing far-right, racist beliefs has been arrested.
Quoting unnamed security sources, The Independent reported this weekend the suspect, Brenton Tarrant, was believed to have met with extreme right-wing groups in Europe two years ago.
“How did we miss this,” a New Zealand Times writer asked. Meanwhile, New Zealand’s Prime Minister Jacinda Ardern has asked agencies to look into whether there were any cues on social media that should have raised flags.
WATCH: Christchurch prepares for burials as victims’ friends, families wait for release of bodies
“Today as we grieve, we are seeking answers,” Ardern said in a speech in which she said the suspect “had not come to the attention of the intelligence community, nor the police, for extremism.”
The manifesto, posted online and sent to dozens of recipients minutes before the attack, said planning had started two years ago, although it’s uncertain how much of the document is truthful.
But CSIS reports obtained under the Access to Information Act by terrorism researcher Prof. Amarnath Amarasingam, as well as other studies, suggest it would be unusual if nobody noticed.
The FBI has also determined that most U.S. active shooters “leaked” their intentions, and each exhibited four to five “concerning behaviors,” although they didn’t necessarily report them to police.
Hints of a person’s transition to violence can range from “very conspicuous expressions of extremist activity to more subtle forms,” CSIS wrote. Even the act of trying to cover up their illicit activities can give away a would-be attacker.
The CSIS research found that women became violent at about the same speed as men but rarely did so alone and were likely to be surrounded by a like-minded group. Youths, however, tended to mobilize faster.
Only in about 10 per cent of cases did subjects move to violence in five days or less. “This finding counters the common perception that people radicalize and subsequently mobilize to violence suddenly and spontaneously,” a CSIS report said.
WATCH: New Zealand PM confirms Christchurch suspect manifesto was received
According to the RCMP’s Terrorism and Violent Extremism Awareness Guide, terrorists “always go through phases of radicalization and planning of their violent actions.”
The signs can include: a significant change in interests, social isolation, a change in peer groups, use of extremist language and attending private ideological meetings.
Watching violent online propaganda, an “us against them” outlook, glorification of violence, a change in appearance and dress, adopting a pseudonym and displaying tattoos or other symbols can also be indicators.
Those planning attacks may be nervous or anxious, be trying to raise money, have unusual web activity, acquire fraudulent identification and uniforms, scout potential targets and pay close attention to security.
WATCH: Turkish foreign minister visits survivors of attack, visits mosque site
“Bystanders (people in a position to observe this information) are critical to the identification and prevention of mobilization to violence,” CSIS wrote in a report released under the Access to Information Act.